Hacker News Reader

Comment by knorker | Hacker News Reader

I run such less trusted programs on other machines. The privilege elevation attack surface is just too big on a normal Linux system.

That's why I think intra-user isolation is better. I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).

View on HN

> I would feel so much better if my browser could just access its settings, the download directory, and read access outside my home directory (for libs and such).

I regularly have to both download files to other directories than my Download folder and upload files from other directories, such a restriction would break a lot of existing use cases.

The optimal way to achieve this would be to have the file / save picker a completely separate process, which then passes a token to the browser, which the browser then exchanges at some sort of "broker" process that returns a handle to the file.

Isn't SELinux supposed to provide exactly this functionality?

The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess.

I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.

SELinux can and does do exactly this, depending on the configuration. What you'll most often see is that applications covered will have rules that allow it to access a subset of the user's home content (xdg cache, data, etc.) that allow that application to function, and SELinux will use UBAC rules to ensure that user A's instance of that application cannot access the data of user B's.

Profiles are indeed tricky though, and generally something I would consider more easily implemented as just logging in as a different user.

I can't speak much about AppArmor since I'm not too familiar with it.

SELinux can do this--think of it as a second layer of security that is checked after the normal DAC checks (e.g., process uid vs file permissions) succeed.

Easiest way to do it is to install via Flatpak, e.g. for Chromium with only access to the Downloads directory:

  sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
  sudo flatpak install -y flathub org.chromium.Chromium
  sudo flatpak override org.chromium.Chromium --nofilesystem=home --filesystem=$HOME/Downloads

> I run such less trusted programs on other machines.

You could probably use Qubes OS instead.

I tried that for a while. Don't remember why I gave up, but it could have been abysmal youtube performance or laptop suspend issues.

It's been a while, though. But now I'm also spoiled with Sway. Haven't checked if I can keep Sway on qubes.

Reply on news.ycombinator.com